Make Your Next Business Trip to Nigeria Count

1. Introduction

Commercium Africa Ltd (the Company) is committed to protecting the privacy and security of personal data. This policy explains how the Company collects, uses, and protects personal data in line with applicable Nigerian data protection requirements and the General Data Protection Regulation (GDPR).

2. Scope

This policy applies to employees, contractors, consultants, temporary staff, third-party personnel, and all personal data processed by the Company in electronic, paper, or other formats.

3. Definitions

• Personal Data: information relating to an identified or identifiable natural person.

• Processing: any operation performed on personal data, including collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, erasure, or destruction.

• Data Subject: an individual whose personal data is processed by the Company.

• Data Controller: the entity that determines why and how personal data is processed.

• Data Processor: the entity that processes personal data on behalf of the Data Controller.

4. Data Protection Principles

The Company processes personal data lawfully, fairly, and transparently; for specified and legitimate purposes; and only to the extent necessary. Data should be accurate, retained only as long as needed, and secured against unauthorised processing, accidental loss, destruction, or damage.

5. Legal Basis for Processing

Personal data is processed only where a valid legal basis applies, including consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a task in the public interest, or legitimate interests that are not overridden by the rights and freedoms of the Data Subject.

6. Data Subject Rights

Subject to applicable law, Data Subjects may request access, correction, erasure, restriction, or portability of their personal data; object to processing; and withdraw consent without affecting processing that was lawful before withdrawal.

7. Data Security

The Company uses appropriate technical and organisational safeguards, which may include encryption, resilient systems, incident recovery measures, and regular assessment of security controls.

8. Data Breach Notification

Where required, the Company will notify the relevant supervisory authority and affected Data Subjects of a personal data breach without undue delay and within the period set by applicable law.

9. Data Protection Officer

The Company appoints a Data Protection Officer to advise on data protection obligations, monitor compliance, support impact assessments, cooperate with supervisory authorities, and act as a contact point for Data Subjects.

10. Data Protection Impact Assessments

The Company conducts Data Protection Impact Assessments for processing activities that are likely to create a high risk to Data Subjects, including relevant new projects and significant changes to existing processing.

11. Training and Awareness

Employees receive appropriate training and awareness support on data protection principles, policies, and practices.

12. Policy Review

This policy is reviewed regularly and updated when necessary to reflect changes in law, regulation, or the Company’s processing activities.

13. Website Security and Cloudflare Turnstile

We use Cloudflare Turnstile in invisible mode to protect website forms from automated abuse. It runs a background security check and may process technical signals such as an IP address, TLS fingerprint, user-agent header, site key, and associated origin. Cloudflare states that Turnstile does not access form entries or other page inputs. Cloudflare’s processing of these security signals is described in the Cloudflare Turnstile Privacy Addendum.

14. Contact Information

Questions or concerns about this policy or the Company’s data protection practices may be submitted through our contact page for the attention of the Data Protection Officer.